# Privacy & Product Counsel

**Company:** [Hilbert](https://hotfix.jobs/companies/hilbert)
**Location:** San Francisco, CA
**Role:** Legal
**Experience:** 6+ years
**Skills:** privacy law, GDPR, CCPA, cpra, data processing agreements, international data transfers, sccs, uk idta, enterprise contract negotiation, privacy by design, ai compliance
**Posted:** 2026-07-22

> Build and run Hilbert's privacy program from within the product for its agentic AI growth platform. Advise on privacy-by-design for agentic workflows, ensure multi-jurisdictional compliance (US, UK, EU), negotiate enterprise DPAs/contracts, and serve as primary legal contact for customers. Requires 6-7 years PQE in privacy/product counsel at data/AI companies.

## Job Description

## Responsibilities
- Design, build, and run Hilbert's privacy program end-to-end — policies, data mapping, retention, and vendor/subprocessor management — covering US and UK/EU entities and data flows.
- Advise product and engineering on privacy-by-design for agentic workflows: what data an agent can access, retain, infer, or act on, and how that's documented and defensible.
- Own compliance posture across CCPA/CPRA, US state privacy laws, UK GDPR/DPA 2018, and EU GDPR; track developing AI-specific rules.
- Build and maintain data processing agreements, international data transfer mechanisms (SCCs, UK IDTA/Addendum), and scalable subprocessor frameworks.
- Review and negotiate enterprise customer contracts, DPAs, and security addenda across US and UK/EU counterparties, working with sales.
- Advise product on building, marketing, and disclosing new agentic features, including human-in-the-loop requirements.
- Partner with security on incident response, breach notification, and customer-facing security representations.
- Serve as primary point of contact for enterprise customers' legal, security, and procurement teams regarding how Hilbert's AI handles their data.
- Act as generalist backstop for other legal questions.

## Requirements
- 6–7 years of post-qualification experience (PQE) in privacy and product/commercial counsel.
- Experience split between in-house work at a data-intensive or AI company and enterprise contract negotiation.
- Genuine fluency across US, UK, and EU privacy law (CCPA/CPRA and state patchwork, UK GDPR/DPA 2018, EU GDPR).
- Product-oriented mindset: prefer shaping data flows in design reviews before build.
- Direct experience negotiating enterprise DPAs, security addenda, and cross-border transfer mechanisms.
- Strong generalist who communicates with clarity and conviction to founders, engineers, and enterprise counsel.
- High ownership and ability to operate in high-autonomy, high-ambiguity startup environment.
- Ability to move at startup speed without heavy process.

## Nice-to-Haves
- Experience with agentic AI systems or data-intensive AI platforms.
- Familiarity with emerging state, federal, UK, and EU AI regulations.

## Similar roles

- [Senior Counsel, Commercial](https://hotfix.jobs/jobs/2be48964-eedd-450e-980f-26b88a3bdbfe) - OpenAI - San Francisco, CA - $297k – $347k/yr
- [Lead Counsel, Commercial & Compliance](https://hotfix.jobs/jobs/6656abf0-5858-492f-b799-a29e1c1de46d) - Tines - Remote - $230k – $250k/yr
- [Senior Counsel, Product](https://hotfix.jobs/jobs/929c33f6-d8e4-40e7-a5bb-dcdc7d490302) - Coinbase - Remote - $225k – $265k/yr
- [Paralegal, Corporate](https://hotfix.jobs/jobs/6367eefd-d059-4409-9e43-fdb2ae694002) - Airbnb - Remote - $102k – $120k/yr
- [Senior Corporate Counsel 2](https://hotfix.jobs/jobs/a2e1742c-8dde-48bb-af66-02b6b79895bf) - Snowflake - Atlanta, GA - $172k – $226k/yr

**Apply:** https://hotfix.jobs/jobs/1a13c5e6-84b3-4ee9-9b33-4856b2c8ab52
**Canonical:** https://hotfix.jobs/jobs/1a13c5e6-84b3-4ee9-9b33-4856b2c8ab52